1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

backport to 5.1 from 6.0

Browse Source 
Bug#35658 (An empty binary value leads to mysqld crash)
  
Before this fix, the following token
  b''
caused the parser to crash when reading the binary value from the empty string.
The crash was caused by:
  ptr+= max_length - 1;
because max_length is unsigned and was 0, causing an overflow.
  
With this fix, an empty binary literal b'' is parsed as a binary value 0,
in Item_bin_string.

mysql-test/r/varbinary.result:
  Bug#35658 (An empty binary value leads to mysqld crash)
mysql-test/t/varbinary.test:
  Bug#35658 (An empty binary value leads to mysqld crash)
sql/item.cc:
  Bug#35658 (An empty binary value leads to mysqld crash)
This commit is contained in:
Gleb Shchepa 2008-06-27 15:23:40 +05:00
parent e72132a5b0
commit cb72f09cfa
3 changed files with 77 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
mysql-test/r/varbinary.result
View File

@ -95,3 +95,34 @@ table_28127_b CREATE TABLE `table_28127_b` (
) ENGINE=MyISAM DEFAULT CHARSET=latin1
drop table table_28127_a;
drop table table_28127_b;
select 0b01000001;
0b01000001
A
select 0x41;
0x41
A
select b'01000001';
b'01000001'
A
select x'41', 0+x'41';
x'41' 0+x'41'
A 65
select N'abc', length(N'abc');
abc length(N'abc')
abc 3
select N'', length(N'');
length(N'')
0
select '', length('');
length('')
0
select b'', 0+b'';
b'' 0+b''
0
select x'', 0+x'';
x'' 0+x''
0
select 0x;
ERROR 42S22: Unknown column '0x' in 'field list'
select 0b;
ERROR 42S22: Unknown column '0b' in 'field list'

28
mysql-test/t/varbinary.test
View File

@ -104,3 +104,31 @@ show create table table_28127_b;
drop table table_28127_a;
drop table table_28127_b;
#
# Bug#35658 (An empty binary value leads to mysqld crash)
#
select 0b01000001;
select 0x41;
select b'01000001';
select x'41', 0+x'41';
select N'abc', length(N'abc');
select N'', length(N'');
select '', length('');
select b'', 0+b'';
select x'', 0+x'';
--error ER_BAD_FIELD_ERROR
select 0x;
--error ER_BAD_FIELD_ERROR
select 0b;

29
sql/item.cc
View File

@ -5172,21 +5172,28 @@ Item_bin_string::Item_bin_string(const char *str, uint str_length)
if (!ptr)
return;
str_value.set(ptr, max_length, &my_charset_bin);
ptr+= max_length - 1;
ptr[1]= 0; // Set end null for string
for (; end >= str; end--)
if (max_length > 0)
{
if (power == 256)
ptr+= max_length - 1;
ptr[1]= 0; // Set end null for string
for (; end >= str; end--)
{
power= 1;
*ptr--= bits;
bits= 0;
if (power == 256)
{
power= 1;
*ptr--= bits;
bits= 0;
}
if (*end == '1')
bits|= power;
power<<= 1;
}
if (*end == '1')
bits|= power;
power<<= 1;
*ptr= (char) bits;
}
*ptr= (char) bits;
else
ptr[0]= 0;
collation.set(&my_charset_bin, DERIVATION_COERCIBLE);
fixed= 1;
}